Privacy policy

Who is responsible

Make My Design Inc., Unit D4, 1105 Crestlawn Dr, Mississauga, Ontario, L4W 1A7, Canada, is responsible for information handled for this website and its printing, design and installation services. Our privacy contact is info@makemydesign.ca; you can also call (437) 605-0404.

This policy explains current practices. A project request, storage-notice acknowledgement or page visit is not blanket consent to unrelated uses or marketing. A new purpose is explained and any required consent obtained before that use begins.

Project requests and artwork

A quote or appointment request collects the details you supply: name, email, phone where provided or required, product specifications, quantity, size, deadline, event or venue details, design choices and message. Appointments include the proposed time and method. Artwork, photographs, guest information and design links are collected when you choose to share them.

We use these details to assess and discuss the project, prepare a quote, review files, arrange appointments and carry out agreed work. References, submission times, delivery states and production notes support that process. Online requests use Cloudflare database and object storage, including saved email envelopes for consistent delivery retries. Resend sends the production notification, which can include artwork, and a fixed quote acknowledgement.

Share only what is needed. Do not upload card details, identity documents or unnecessary sensitive information. Obtain permission for other people’s photographs or information. Submission does not authorise advertising or portfolio use of customer artwork or personal information.

A delivery failure can leave a saved request awaiting retry. A receipt is not an accepted order or payment. Email or WhatsApp drafts are sent only when you send them using the external service.

Before submission

Contact details normally remain in the open form until sent and may be lost on refresh. Some design tools keep an artwork file or link in browser IndexedDB for carry-over to the quote page. These drafts expire after one hour and are cleaned up on the store’s next access, not while the browser is closed.

A successful quote attempts to remove its associated local artwork draft. Storage failures can delay removal. Browser storage is not a cloud backup or a way to synchronise files between devices. See Cookies & storage for named items and clearing choices.

Conversations with a person

Chat asks for your name, email and agreement once. Your contact details stay in the open chat’s memory until a handoff and are not included in automated-assistant requests. If you ask for a person, the assistant cannot answer or its connection fails, the website sends those details and a bounded copy of the current conversation to the private team inbox so you do not have to repeat your question. You can also choose the team directly.

Messages, contact details, team replies, references and timestamps stay in the private website database. Only the authorised owner can use the staff inbox. Giving an email address does not subscribe you to marketing or enable automatic email replies.

A random secret token in your browser tab provides access; the database stores its hash. Treat a shared device as shared access. Human chats expire after seven days and become inaccessible through the service. Physical removal happens in bounded cleanup when new chats are prepared or the owner opens the inbox; it is not a continuous deletion job. Platform logs and backups can have different retention.

Online status means the owner recently chose Available with the inbox visible. Replies are not guaranteed immediately. Away messages can wait for review, and incoming website chats currently trigger no email or WhatsApp alert. Use direct contact for urgent matters.

Automated answers and FAQ review

The assistant uses website information and owner-approved FAQs. If optional AI fallback is configured, an unresolved question can go to OpenAI; configured team alerts can send it through Meta WhatsApp. Opening chat does not itself enable those integrations. Avoid private project, credential or financial information. A provider setting disabling response storage does not guarantee zero provider retention.

The website can retain a filtered general-question pattern for FAQ improvement. Obvious contact details and links are removed or the question is skipped; screening cannot reliably recognise every personal detail in free text. The queue has no visitor identity, network address or full transcript. Patterns, counts, timestamps and draft answers expire after 30 days; expired records are excluded from review and removed in bounded cleanup on later question activity.

Private queue entries never automatically become public answers. The owner must review and publish a general FAQ. Approved FAQ text and change records remain until separately edited or removed. We do not intentionally publish private customer briefs.

Aggregate page-view counts

We count loads of a limited list of catalogue and marketing pages. The traffic table stores only the Toronto day, approved path and count. It does not store a visitor name, identifier, raw network address, query string, referrer or full URL. Owner pages, APIs, quotes, calculators, design tools, appointments and sign-in routes are excluded, along with recognised signed-in owner activity.

These are page views, not unique people. Repeat loads and some automated traffic may count; failed or blocked requests may not. No tracking cookie, fingerprint or persistent visitor ID is created. Aggregate rows older than the 90-day window are removed during traffic or operations activity.

A separate short-lived hashed network-address key limits counting abuse. It is not stored in the aggregate table. The hosting platform can separately process network, access and security logs.

Optional news and offers

A visit, quote, chat or payment does not subscribe you to marketing. Optional sign-up uses a separate unchecked choice and email confirmation. Records contain the address, notice version, request and confirmation times and subscription or suppression state. Confirmation and unsubscribe tokens are stored as hashes.

Confirmation expires after 24 hours. Unconfirmed records are removed in bounded cleanup during later operations or sign-up activity. The current budget allows up to ten confirmation emails daily. There is no bulk campaign dispatch: drafts and record exports do not send marketing.

Use the unsubscribe link in mailing correspondence or contact info@makemydesign.ca to withdraw optional mailing consent. Quote and order correspondence is separate. Unsubscribed or suppressed records are retained to prevent accidental re-addition; rejoining after opt-out requires separate review. Confirmed consent and suppression records have no fixed automatic deletion schedule; they need review when no longer necessary or on a privacy request. Exported copies require the same care and current suppression checks.

Owner controls and catalogue images

The protected dashboard lets the owner review private requests and chats, save production notes, edit products and pricing, prepare drafts and view aggregate counts. Change records can include the owner’s site identity, time, action, record reference and revision. Product and price drafts, published versions and histories are separate from private customer records.

Owner-uploaded product images are intended for the catalogue. Draft assets require owner access; images selected in a published product can be served to website visitors. Quote artwork is stored separately and is not automatically published. Publishing customer work or an identifiable person’s image requires the relevant permission.

The email centre shows saved website-generated messages. It is not connected to the full Microsoft 365 / GoDaddy mailbox or unrelated incoming mail. Downloads and exports create copies outside the website.

Providers and disclosures

Authorised people and providers handle information needed for the service, and information can be disclosed as permitted or required by law. We do not sell customer personal information. Processing, support or backups can occur outside Canada and be subject to foreign lawful access; Canada-only storage is not promised.

• Sites and Cloudflare: hosting, access controls, security processing, database and object storage.
• Resend: production, acknowledgement and subscription-confirmation emails, with artwork attachments where supplied.
• Microsoft 365 / GoDaddy email: business correspondence and attachments, under mailbox settings and retention separate from the website archive.
• Intuit QuickBooks and banking providers: separately arranged invoices, hosted payments, accounting and e-transfer records.
• Optional appointment and assistant providers: Twilio for configured appointment texts, team-supplied Zoom links for meetings, and configured OpenAI or Meta services for the assistant use described above. The website does not create Zoom meetings.

Email, WhatsApp, Instagram, Google Maps and design links lead to other services when selected. Their notices apply to information you give them. This policy does not grant unrestricted third-party access.

Retention and your rights

Information is kept for identified service, consent, security or lawful record purposes. Quote records, artwork, saved email envelopes, production notes and some administration records do not yet have a fixed automatic deletion schedule. They require review according to project status, follow-up and applicable obligations. The shorter draft, chat, question-queue and aggregate-count windows above apply to those particular features.

Ask our privacy contact about information held about you, its uses and disclosures, access, correction, consent withdrawal or deletion. Include a reference where available. We may need proportionate verification; do not send identity documents until we agree a suitable method. Withdrawing information necessary for a service can prevent completion.

We respond under applicable privacy law. Where PIPEDA applies, the ordinary access-response period is 30 calendar days, with only lawful extensions and required notice. We explain any lawful refusal or retention requirement and how to raise a concern. You may complain to the Office of the Privacy Commissioner of Canada.

Copies can exist in emails, exports, provider systems and backups. Removing one record does not immediately erase every copy; legal holds or required records can restrict deletion. We review the whole request rather than promise unconditional erasure.

Payments and safeguards

The website does not collect or store card numbers or banking credentials. Interac e-Transfer is arranged against a confirmed invoice through the customer’s own bank. The team manually confirms receipt. Credit card, debit card and pay-later options are coming soon on this website. QuickBooks remains a separate invoicing and accounting service. The website cannot automatically create invoices, charge cards, refund or confirm payments. Klarna is not connected. See our payment options for current instructions.

Application safeguards include owner-only administration, secure connections, input and upload validation, separated private storage, request limits and limited error messages. Temporary abuse keys are not marketing profiles. No system guarantees protection from every attack.

Report suspected exposure privately. We assess incidents and any reporting, notification, recordkeeping and remedial obligations under applicable law. Do not publish the affected information. Cookies & storage describes essential browser storage and the information-only acknowledgement.

Updates and questions

Updates are dated above. A new policy does not by itself authorise a new purpose requiring consent. Contact info@makemydesign.ca about questions or complaints; our address and phone are also shown below.